[all-commits] [llvm/llvm-project] 2120f5: Reapply [workflows] Split pr-code-format into two ...

[Tom Stellard via All-commits]

  Branch: refs/heads/main
  Home:   https://github.com/llvm/llvm-project
  Commit: 2120f574103c487787390263b3692c4b167f6bdf
      https://github.com/llvm/llvm-project/commit/2120f574103c487787390263b3692c4b167f6bdf
  Author: Tom Stellard <tstellar at redhat.com>
  Date:   2024-03-22 (Fri, 22 Mar 2024)

  Changed paths:
    A .github/workflows/issue-write.yml
    M .github/workflows/pr-code-format.yml
    M llvm/utils/git/code-format-helper.py

  Log Message:
  -----------
  Reapply [workflows] Split pr-code-format into two parts to make it more secure (#78215) (#80495)

Actions triggered by pull_request_target events have access to all
repository secrets, so it is unsafe to use them when executing untrusted
code. The pr-code-format workflow does not execute any untrusted code,
but it passes untrused input into clang-format. An attacker could use
this to exploit a flaw in clang-format and potentially gain access to
the repository secrets.
    
By splitting the workflow, we can use the pull_request target which is
more secure and isolate the issue write permissions in a separate job.
The pull_request target also makes it easier to test changes to the
code-format-helepr.py script, because the version of the script from the
pull request will be used rather than the version of the script from
main.
    
Fixes #77142



To unsubscribe from these emails, change your notification settings at https://github.com/llvm/llvm-project/settings/notifications